PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

Unit 42 researchers have uncovered a new fileless ARM64 implant called PEERSTITCH, deployed by a sophisticated threat actor after exploiting a privilege-escalation path traversal bug in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager tracked as CVE-2025-61624 (CVSS 5.4). Fortinet patched this flaw in April 2026, but the attackers used it as a follow-on step in a long-running intrusion against a telecom managed service provider, originally initiated via the FortiManager FortiJump bug CVE-2024-47575. Rather than running as a standalone process, PEERSTITCH injects hooks into the legitimate miglogd and iked daemons, letting it hide session markers and bypass normal FortiOS VPN validation checks without opening ports or writing persistent files to disk. The campaign, dubbed CL-STA-0954 (aka UNC5820), also harvested configuration data and credentials from over 500 managed FortiGate firewalls, highlighting the risk of centralized edge-management platforms being weaponized to pivot into downstream customer networks.